As more and more developers arrive back home from France, more reports arrive to you to keep you informed of what happened in Nantes. This time, it's Philip Guenther (guenther@) who writes in with his report:
In this commit, visa@ submitted code (disabled for now) to use built-in accelerationon octeon CPUs, much like AESNI for x86s.I decided to test tcpbench(1) and IPsec, before and after updating and enabling the octcrypto(4) driver.Read more…
Mike Larkin (mlarkin@) has just given a presentation atbhyvecon Tokyo 2018.The slides are nowavailable (as PDF).In addition to the excellent summary of the state-of-play forvmmand friends, the presentation offers a tantalizing glimpse at possible futuredirections.Update: videois available
Good news for people doing upgrades only once per year: syspatches will be provided for both supported releases. The commit from T.J. Townsend (tj@) speaks for itself:
The recent changes in -current mitigating the Meltdown vulnerability have been backported to the6.1 and6.2(amd64) releases, and thesyspatch update (for 6.2) is now available.Happy syspatching, and don't forget to show your appreciation bydonating to the project.
Meltdown mitigation is coming to OpenBSD. Philip Guenther (guenther@) has just committed a diff that implements a new mitigation technique to OpenBSD: Separation of page tables for kernel and userland. This fixes the Meltdown problems that affect most CPUs from Intel. Both Philip and Mike Larkin (mlarkin@) spent a lot of time implementing this solution, talking to various people from other projects on best approaches.In the commit message, Philip briefly describes the implementation:Read more…
As you may have heard, the a2k18 hackathon is in progress. As can be seen from the commit messages, several items of goodness are being worked on.One eagerly anticipated item is the arrival of TCP syncookies (read: another important tool in your anti-DDoS toolset) in PF. Henning Brauer (henning@) added the code in a series of commits on February 6th, 2018, with this one containing the explanation:Read more…
Details of the2018 campaign have been added to the Foundation's website. The goal for theyear is for $300,000. The total for "smaller" donations has alreadytaken the OpenBSD community to bronze level sponsorship!Please show your support by contributing.
Patrick Wildt (patrick@) recently committed some code that will update the Intel microcode on many Intel CPUs, a diff initially written by Stefan Fritsch (sf@). The microcode of your CPU is basically the firmware that runs on your (Intel) processor, defining its instruction set in terms of so called "microinstructions". The new code depends, of course, on the corresponding firmware package, ported by Patrick which can be installed using a very recent fw_update(1). Of course, this all plays into the recently revealed problems in Intel (and other) CPUs, Meltdown and Spectre.Read more…
If you run a mail service, you probably like to have greylisting in place, via spamd(8) or similar means. However, there are some sites that simply do not play well with greylisting, and for those it's useful to extract SPF information to identify their valid outgoing SMTP hosts. Now OpenBSD offers a straightforward mechanism to do that and fill your nospamd table, right from the smtpctl utility via the subcommand spf walk. Gilles Chehade (gilles@) describes how in a recent blog post titled spfwalk.This feature is still in need of testing, so please grab a snapshot and test!
Amessage to tech@from Philip Guenther (guenther@) provides the first publicinformation from developers regarding the OpenBSD response to the recentlyannouncedCPU vulnerabilities:
arm64 is now anofficially supported platform for OpenBSD.As some readers will have noticed,there's nowsyspatch(8) support, too.Theo de Raadt (deraadt@) committed the following change: